From patchwork Sat Oct 28 12:58:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hou Tao X-Patchwork-Id: 10030981 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id F08486032C for ; Sat, 28 Oct 2017 12:54:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E2DF62883B for ; Sat, 28 Oct 2017 12:54:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D72A528ADF; Sat, 28 Oct 2017 12:54:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6A57C2883B for ; Sat, 28 Oct 2017 12:54:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751442AbdJ1Mwk (ORCPT ); Sat, 28 Oct 2017 08:52:40 -0400 Received: from szxga04-in.huawei.com ([45.249.212.190]:9468 "EHLO szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751266AbdJ1Mwb (ORCPT ); Sat, 28 Oct 2017 08:52:31 -0400 Received: from 172.30.72.59 (EHLO DGGEMS408-HUB.china.huawei.com) ([172.30.72.59]) by dggrg04-dlp.huawei.com (MOS 4.4.6-GA FastPath queued) with ESMTP id DJY13231; Sat, 28 Oct 2017 20:52:20 +0800 (CST) Received: from huawei.com (10.175.124.28) by DGGEMS408-HUB.china.huawei.com (10.3.19.208) with Microsoft SMTP Server id 14.3.361.1; Sat, 28 Oct 2017 20:52:14 +0800 From: Hou Tao To: CC: , , , , , Subject: [RFC][PATCH 4/8] epoll: free eventpoll by rcu to provide existence guarantee Date: Sat, 28 Oct 2017 20:58:23 +0800 Message-ID: <1509195507-29037-5-git-send-email-houtao1@huawei.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1509195507-29037-1-git-send-email-houtao1@huawei.com> References: <1509195507-29037-1-git-send-email-houtao1@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.124.28] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.59F47D84.004C, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 7c5bfbc42a1c7a8246c5aded4cade492 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Before the removal of epmutex, it's OK to access epi->ep in reverse_path_check_proc(), because the freeing of ep will be blocked on ep_free(). After the removal of epmutex, when accessing epi->ep in reverse_path_check_proc(), it's possible that it has been release because this eventpoll struct belongs to an epoll fd which also polls the target file. So freeing eventpoll by rcu to ensure the accessed fields of eventpoll are still valid when invoking reverse_path_check_proc(). Signed-off-by: Hou Tao --- fs/eventpoll.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 998c635..18de596 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -230,6 +230,9 @@ struct eventpoll { /* used to track busy poll napi_id */ unsigned int napi_id; #endif + + /* used to free itself */ + struct rcu_head rcu; }; /* Wait structure used by the poll hooks */ @@ -818,6 +821,12 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi) return 0; } +static void ep_rcu_free(struct rcu_head *head) +{ + struct eventpoll *ep = container_of(head, struct eventpoll, rcu); + kfree(ep); +} + static void ep_free(struct eventpoll *ep) { struct rb_node *rbp; @@ -877,7 +886,8 @@ static void ep_free(struct eventpoll *ep) mutex_destroy(&ep->mtx); free_uid(ep->user); wakeup_source_unregister(ep->ws); - kfree(ep); + + call_rcu(&ep->rcu, ep_rcu_free); } static int ep_eventpoll_release(struct inode *inode, struct file *file)